Privacy Policy

Last updated: 12 October 2026

This notice describes how the personal data of users who visit the website innot-it.com (hereinafter the "Site") and who contact us through the forms and channels on the Site are processed, pursuant to art. 13 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller

INNOT by Giammarco Turati
Via San Ponso, 57 – 10080 Pertusio (TO)
VAT No.: IT13269100015
Phone: +39 375 7861361
Email: info@innot-it.com

2. Data processed

a) Data voluntarily provided by the user

When the user fills in the "Request a quote" form, writes to our email address, phones us or contacts us via WhatsApp, we collect the data they provide: first and last name, company name, email address, phone number, products, codes, requested quantities and any notes.

b) Registration data and reserved area for companies

Registration on the Site is reserved for companies. To create an account we collect first name, last name, company name, country, VAT number (mandatory), email, phone number and encrypted password. The VAT number is checked with the European Commission’s VIES service, which returns the name and address registered for that number. Before enabling access to prices and documents, we verify that the user really works for the company indicated.

In the reserved area we keep, for each company: the history of requests sent, our replies and attachments, including the emails exchanged about each request; the reserved prices, quotations and order confirmations we send to the company, from which the Site automatically reads items, quantities and amounts to build the price list and the cost summary; any comparison prices and data entered by the user to calculate savings. These data are visible to all enabled users of the same company, who can also see their colleagues’ names, email addresses and date of last login. We record the date of each user’s last login also to protect accounts from unauthorised use.

c) Browsing data and visit statistics

The computer systems that run the Site acquire, during normal use, certain technical data whose transmission is implicit in the use of Internet protocols (for example IP address, browser type, date and time of the request, pages visited). These data are used only to ensure the proper functioning and security of the Site.

To know how many people visit the Site and how they use it, we use an internal statistics counter that does not use cookies and does not store the IP address. For each page viewed we record the page, the date and time, the referring site (for example a search engine), the device type and the Site language; we also record the main actions taken on the page (for example quote requests, clicks on phone, email or WhatsApp, downloads of datasheets and CAD files, use of the 3D view, terms searched and filters used in the catalogue, reading time and how much of the page was viewed), without ever recording what is typed into forms. The country and approximate location (city or town and region) are derived from the IP address at the time of the visit using a geographic database installed on our own server (DB-IP), without storing the IP address and without sending it to third parties; the location is indicative and often corresponds to the city of the internet provider. To count each person only once per day, the IP address and browser type are turned into an anonymous code with a key that changes every day: the previous day’s key is deleted and from then on the code can no longer be traced back to anyone. If the user is logged in to the reserved area, the visit is associated with their company. These data are consulted only by the Controller, also visit by visit but always in pseudonymous form, and are not used for commercial profiling or shared with third parties.

With the same counter we also measure how fast pages load on the visitor’s device: loading and response times, page stability while loading, type of device and connection (for example 4G). These measurements contain no code or data that could identify the visitor and are used only to make the Site faster.

d) Cookies

The Site only uses technical cookies, necessary for it to work (for example to remember the chosen language and to keep users logged in to the reserved area), for which no consent is required. The Site does not use profiling cookies or third-party statistics cookies, and for this reason it does not show a cookie banner. For details please refer to the Cookie Policy.

e) Newsletter and email communications

If the user subscribes to the newsletter from the «Offers of the month» window, we collect the email address and, if provided, name and company, together with the language, the page from which they subscribed and the date and time of subscription and confirmation. The subscription becomes active only after the user has confirmed their address with the link received by email. So as not to show the window again, the browser only remembers that the user closed it or subscribed (local browser storage, no personal data).

INNOT may send its customers, who provided their address when making a purchase, emails about products and services similar to those purchased, and the newsletter to subscribers. For each mailing we record the date, any clicks on the links in the email (to know which content is of interest and to reply to those who ask for information) and failed deliveries, to exclude non-existent addresses; we also record whether and when the email is opened, by means of an invisible image contained in the email (an indicative figure: some email programs block images or download them automatically). Every email contains a link to stop receiving them, effective immediately.

f) Push notifications

If the user turns on the Site notifications (on a computer or phone, including the installed INNOT app), the browser creates a technical delivery address with its own notification service (Google, Mozilla, Apple or Microsoft, depending on the browser) together with two encryption keys: we store these data together with the language, the device type and the activation date, without name, email or IP address. Alerts are encrypted on our server and only the user’s device can read them; we only count, in aggregate form, how many notifications were delivered and opened. So as not to show the box again, the browser only remembers whether the user closed it or turned notifications on and how many pages were viewed (browser local storage, no personal data). Notifications can be turned off at any time from the “INNOT notifications” box on the Site or from the browser settings.

g) Testimonials

If a customer tells us about their experience on the «Your experience with INNOT» page, we collect name, company, email and, if provided, role, city, phone, operation, measured results and any photo. Email and phone are used only to contact them and are never published. The testimonial is published on the Site only if the customer chose so, in the form indicated (with name, role and company, or with initials only), after a check on our side that may correct typos without changing its meaning.

3. Purposes and legal basis of processing

• Responding to quote and information requests and managing commercial negotiations: the legal basis is the performance of pre-contractual measures taken at the request of the data subject (art. 6(1)(b) GDPR).
• Managing orders, supplies and contractual relationships, including technical support: performance of the contract (art. 6(1)(b) GDPR).
• Managing the reserved area for companies (prices, quotations, orders, cost and savings summary): performance of the contract or of pre-contractual measures (art. 6(1)(b) GDPR).
• Verifying the identity of those who register and protecting each company’s confidential data from unauthorised access: legitimate interest of the Controller and of its customer companies (art. 6(1)(f) GDPR).
• Complying with legal obligations, for example tax and accounting: legal obligation (art. 6(1)(c) GDPR).
• Ensuring the security of the Site, preventing abuse and protecting our rights: legitimate interest of the Controller (art. 6(1)(f) GDPR).
• Internal visit statistics, without cookies: legitimate interest of the Controller in knowing how the Site is used in order to improve it (art. 6(1)(f) GDPR).
• Sending the newsletter and promotional offers: consent of the user (art. 6(1)(a) GDPR), which can be withdrawn at any time with the link in every email or by writing to info@innot-it.com.
• Email communications to customers about similar products to those purchased: legitimate interest of the Controller (art. 6(1)(f) GDPR and art. 130(4) of Italian Legislative Decree 196/2003), with the right to object at any time with the link in every email or by writing to info@innot-it.com.
• Sending push notifications (product news, technical guides and offers): consent given by the user by turning notifications on (art. 6(1)(a) GDPR), which can be withdrawn at any time by turning them off.
• Publishing customer testimonials on the Site: consent of the data subject (art. 6(1)(a) GDPR), which can be withdrawn at any time by asking us to edit or remove the testimonial.

Data collected for quote requests and for the reserved area are not used for marketing purposes. Customers who have made a purchase may receive emails about similar products, under the conditions described above; the newsletter with the offers of the month is sent only to those who subscribe with specific and separate consent. Data are not transferred to third parties for marketing purposes.

4. Nature of the provision of data

Providing the data marked as mandatory in the request and registration forms is necessary: without them it will not be possible to prepare the quotation or create the account. Providing the other data is optional.

5. Processing methods

Data are processed with electronic and, where necessary, paper tools, adopting appropriate technical and organisational measures to protect them from unauthorised access, loss or destruction. The documents of the reserved area are stored in a part of the server that cannot be accessed from the web and can be downloaded only by enabled users of the same company.

6. Data recipients

Data may be disclosed, to the extent necessary for the stated purposes, to:

• IT, website hosting and email service providers, acting as data processors;
• jsDelivr and cdnjs (Cloudflare), content delivery networks from which the browser downloads some technical libraries of the Site (3D animations and flip-through catalogue): they receive the visitor’s IP address, needed to deliver the files, without cookies;
• the browser notification services (Google, Mozilla, Apple, Microsoft), which deliver the encrypted push notifications to the device, only for users who turned them on;
• the European Commission, through the VIES service, to which the VAT number entered at registration is sent to check its validity;
• couriers and forwarders, for the delivery of ordered goods;
• accountant and consultants, for tax and administrative obligations;
• public authorities, when required by law.

Data are not disseminated.

7. Transfer of data outside the European Union

If the user chooses to contact us via WhatsApp, the conversation data are also processed by WhatsApp Ireland Ltd. (Meta group), according to its privacy policy, and may be transferred outside the European Union on the basis of the safeguards provided by the GDPR. The use of WhatsApp is optional: the user can always contact us by email or phone.

The internal statistics counter runs entirely on the Site’s server and does not send data to third parties.

Push notifications are delivered by the notification service of the browser chosen by the user, which may be based or have servers outside the European Union (for example Google LLC, Apple Inc. or Microsoft Corporation), on the basis of the safeguards provided by the GDPR; the content of the notifications travels encrypted and the service cannot read it.

8. Retention period

• Quote and information requests that do not result in a business relationship: 24 months from the last contact.
• Data relating to orders, contracts and invoicing: 10 years, as required by tax and civil law (art. 2220 of the Italian Civil Code).
• Customer account data, reserved area data and request archive: until the account is deleted at the user’s request; quotations, orders and requests that led to orders follow the retention periods for orders and invoicing.
• Internal visit statistics: 13 months, then automatically deleted.
• Newsletter: until the subscription is cancelled. Unconfirmed subscriptions are deleted after 30 days; after cancellation we keep only the email address and the subscription and cancellation dates for 24 months, to show that the user's choice has been respected.
• Email communications to customers: until the customer objects; the data of individual mailings (date, opening, clicks and failed deliveries) are automatically deleted after 24 months.
• Push notifications: until they are turned off; delivery addresses that are turned off or reported as expired by the notification service are deleted immediately and automatically.
• Testimonials: published ones remain on the Site until the customer asks for their removal; unpublished ones are kept like information requests (24 months from the last contact).
• Browsing data: for the time strictly necessary for the security of the Site.

9. Rights of the data subject

The user may at any time exercise the rights provided for by arts. 15–22 GDPR: access to their data, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interest. Consent to the newsletter can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Consent to push notifications can be withdrawn at any time by turning them off on the Site or in the browser settings.

Consent to the publication of a testimonial can be withdrawn at any time: we remove it from the Site as soon as we receive the request.

To exercise them, simply write to info@innot-it.com. We will reply within 30 days.

The user also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

10. Minors

The Site is aimed at professionals and companies and is not intended for persons under 18.

11. Changes to this notice

The Controller may update this notice. The version in force is always the one published on this page, with the date of the last update shown at the top.